CWE-912
Hidden Functionality
The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
CVE-2020-3352 (GCVE-0-2020-3352)
Vulnerability from cvelistv5 – Published: 2020-10-21 18:36 – Updated: 2024-11-13 17:48
VLAI
Title
Cisco Firepower Threat Defense Software Hidden Commands Vulnerability
Summary
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this vulnerability by performing specific steps that make the hidden commands accessible. A successful exploit could allow the attacker to make configuration changes to various sections of an affected device that should not be exposed to CLI access.
Severity
5.3 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://tools.cisco.com/security/center/content/C… | vendor-advisoryx_refsource_CISCO |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Firepower Threat Defense Software |
Affected:
n/a
|
Date Public
2020-10-21 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:30:58.147Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20201021 Cisco Firepower Threat Defense Software Hidden Commands Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-hidcmd-pFDeWVBd"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-3352",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-13T17:22:49.430236Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T17:48:10.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Firepower Threat Defense Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2020-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this vulnerability by performing specific steps that make the hidden commands accessible. A successful exploit could allow the attacker to make configuration changes to various sections of an affected device that should not be exposed to CLI access."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-10-21T18:36:38.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20201021 Cisco Firepower Threat Defense Software Hidden Commands Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-hidcmd-pFDeWVBd"
}
],
"source": {
"advisory": "cisco-sa-ftd-hidcmd-pFDeWVBd",
"defect": [
[
"CSCvq43920"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Firepower Threat Defense Software Hidden Commands Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2020-10-21T16:00:00",
"ID": "CVE-2020-3352",
"STATE": "PUBLIC",
"TITLE": "Cisco Firepower Threat Defense Software Hidden Commands Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco Firepower Threat Defense Software",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this vulnerability by performing specific steps that make the hidden commands accessible. A successful exploit could allow the attacker to make configuration changes to various sections of an affected device that should not be exposed to CLI access."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "5.3",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20201021 Cisco Firepower Threat Defense Software Hidden Commands Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-hidcmd-pFDeWVBd"
}
]
},
"source": {
"advisory": "cisco-sa-ftd-hidcmd-pFDeWVBd",
"defect": [
[
"CSCvq43920"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2020-3352",
"datePublished": "2020-10-21T18:36:38.357Z",
"dateReserved": "2019-12-12T00:00:00.000Z",
"dateUpdated": "2024-11-13T17:48:10.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-24867 (GCVE-0-2021-24867)
Vulnerability from cvelistv5 – Published: 2022-02-21 10:45 – Updated: 2024-08-03 19:49
VLAI
Title
Backdoored Plugins & Themes from AccessPress Themes
Summary
Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion
Severity
No CVSS data available.
CWE
- CWE-912 - Hidden Functionality
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/9c76bada-fa32-4c… | x_refsource_MISC |
| https://jetpack.com/2022/01/18/backdoor-found-in-… | x_refsource_MISC |
Impacted products
93 products
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:49:13.412Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Frontend Post WordPress Plugin \u2013 AccessPress Anonymous Post",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.8.0*",
"status": "affected",
"version": "2.8.0",
"versionType": "custom"
},
{
"lessThan": "2.8.1",
"status": "affected",
"version": "2.8.1",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Custom CSS",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.1*",
"status": "affected",
"version": "2.0.1",
"versionType": "custom"
},
{
"lessThan": "2.0.2",
"status": "affected",
"version": "2.0.2",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Custom Post Type",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.8*",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
},
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
}
]
},
{
"product": "Social Auto Poster",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.1.3*",
"status": "affected",
"version": "2.1.3",
"versionType": "custom"
},
{
"lessThan": "2.1.4",
"status": "affected",
"version": "2.1.4",
"versionType": "custom"
}
]
},
{
"product": "AccessPress iFeeds",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "4.0.3*",
"status": "affected",
"version": "4.0.3",
"versionType": "custom"
},
{
"lessThan": "4.0.4",
"status": "affected",
"version": "4.0.4",
"versionType": "custom"
}
]
},
{
"product": "PI Button",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "3.3.3*",
"status": "affected",
"version": "3.3.3",
"versionType": "custom"
},
{
"lessThan": "3.3.4",
"status": "affected",
"version": "3.3.4",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Social Counter",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.9.1*",
"status": "affected",
"version": "1.9.1",
"versionType": "custom"
},
{
"lessThan": "1.9.2",
"status": "affected",
"version": "1.9.2",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Social Icons",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.8.2*",
"status": "affected",
"version": "1.8.2",
"versionType": "custom"
},
{
"lessThan": "1.8.3",
"status": "affected",
"version": "1.8.3",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Social Login Lite \u2013 Social Login WordPress Plugin",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "3.4.7*",
"status": "affected",
"version": "3.4.7",
"versionType": "custom"
},
{
"lessThan": "3.4.8",
"status": "affected",
"version": "3.4.8",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Social Share",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "4.5.5*",
"status": "affected",
"version": "4.5.5",
"versionType": "custom"
},
{
"lessThan": "4.5.6",
"status": "affected",
"version": "4.5.6",
"versionType": "custom"
}
]
},
{
"product": "TAuto Poster",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.4.5*",
"status": "affected",
"version": "1.4.5",
"versionType": "custom"
},
{
"lessThan": "1.4.6",
"status": "affected",
"version": "1.4.6",
"versionType": "custom"
}
]
},
{
"product": "WP TFeed",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.6.7*",
"status": "affected",
"version": "1.6.7",
"versionType": "custom"
},
{
"lessThan": "1.6.8",
"status": "affected",
"version": "1.6.8",
"versionType": "custom"
}
]
},
{
"product": "Effectively Add \u0026 Customize Free Icons For WordPress Menus \u2013 WP Menu Icons Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
}
]
},
{
"product": "AP Companion",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.7",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
}
]
},
{
"product": "Easiest Contact Form for WordPress \u2013 AP Contact Form",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.6*",
"status": "affected",
"version": "1.0.6",
"versionType": "custom"
},
{
"lessThan": "1.0.7",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
}
]
},
{
"product": "Testimonial WordPress Plugin \u2013 AP Custom Testimonial",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.4.6*",
"status": "affected",
"version": "1.4.6",
"versionType": "custom"
},
{
"lessThan": "1.4.7",
"status": "affected",
"version": "1.4.7",
"versionType": "custom"
}
]
},
{
"product": "Mega Menu Plugin for WordPress \u2013 AP Mega Menu",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "3.0.5*",
"status": "affected",
"version": "3.0.5",
"versionType": "custom"
},
{
"lessThan": "3.0.6",
"status": "affected",
"version": "3.0.6",
"versionType": "custom"
}
]
},
{
"product": "Pricing Table Builder \u2013 AP Pricing Tables Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"changes": [
{
"at": "1.1.3",
"status": "unaffected"
}
],
"lessThan": "1.1.3*",
"status": "affected",
"version": "1.1.3",
"versionType": "custom"
}
]
},
{
"product": "Responsive Notification Bar Plugin for WordPress \u2013 Apex Notification Bar Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.4*",
"status": "affected",
"version": "2.0.4",
"versionType": "custom"
},
{
"lessThan": "2.0.5",
"status": "affected",
"version": "2.0.5",
"versionType": "custom"
}
]
},
{
"product": "Form Store to DB",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.9*",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
},
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
}
]
},
{
"product": "Comments Disable \u2013 AccessPress",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.7*",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
},
{
"lessThan": "1.0.8",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
}
]
},
{
"product": "CTA plugin for WordPress \u2013 Easy Side Tab",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.7*",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
},
{
"lessThan": "1.0.8",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
}
]
},
{
"product": "WordPress Backend Customizer \u2013 Everest Admin Theme Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.7*",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
},
{
"lessThan": "1.0.8",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
}
]
},
{
"product": "Ultimate Coming Soon, Maintenance Mode Plugin for WordPress \u2013 Everest Coming Soon Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.0*",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
},
{
"lessThan": "1.1.1",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
}
]
},
{
"product": "Free WordPress Plugin To Display Like/Dislike Comment Rating \u2013 Everest Comment Rating Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.4*",
"status": "affected",
"version": "2.0.4",
"versionType": "custom"
},
{
"lessThan": "2.0.5",
"status": "affected",
"version": "2.0.5",
"versionType": "custom"
}
]
},
{
"product": "Beautiful Stat Counter Plugin for WordPress \u2013 Everest Counter Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.7*",
"status": "affected",
"version": "2.0.7",
"versionType": "custom"
},
{
"lessThan": "2.0.8",
"status": "affected",
"version": "2.0.8",
"versionType": "custom"
}
]
},
{
"product": "Beautiful FAQ Plugin for WordPress \u2013 Everest FAQ Manager Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.8*",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
},
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
}
]
},
{
"product": "Responsive Media Gallery Plugin for WordPress \u2013 Everest Gallery Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.8*",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
},
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
}
]
},
{
"product": "Everest GPlaces Business Reviews",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.9*",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
},
{
"lessThan": "2.0.0",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"product": "Everest Review Lite \u2013 User/Admin review plugin for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.7"
}
]
},
{
"product": "Free Responsive Tab Plugin For WordPress \u2013 Everest Tab Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.3*",
"status": "affected",
"version": "2.0.3",
"versionType": "custom"
},
{
"lessThan": "2.0.4",
"status": "affected",
"version": "2.0.4",
"versionType": "custom"
}
]
},
{
"product": "Responsive WordPress Timeline Plugin \u2013 Everest Timeline Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.1*",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.1.2",
"status": "affected",
"version": "1.1.2",
"versionType": "custom"
}
]
},
{
"product": "Inline Call To Action Builder Lite \u2013 Free Call To Action Layer Plugin for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.0*",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
},
{
"lessThan": "1.1.1",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
}
]
},
{
"product": "Product Slider For WooCommerce Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.5*",
"status": "affected",
"version": "1.1.5",
"versionType": "custom"
},
{
"lessThan": "1.1.6",
"status": "affected",
"version": "1.1.6",
"versionType": "custom"
}
]
},
{
"product": "Responsive Clients Logo Gallery Plugin for WordPress \u2013 Smart Logo Showcase Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.7*",
"status": "affected",
"version": "1.1.7",
"versionType": "custom"
},
{
"lessThan": "1.1.8",
"status": "affected",
"version": "1.1.8",
"versionType": "custom"
}
]
},
{
"product": "Smart Scroll Posts for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.8*",
"status": "affected",
"version": "2.0.8",
"versionType": "custom"
},
{
"lessThan": "2.0.9",
"status": "affected",
"version": "2.0.9",
"versionType": "custom"
}
]
},
{
"product": "Faster and Easier scroll to Top Plugin for WordPress \u2013 Smart Scroll to Top Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.3*",
"status": "affected",
"version": "1.0.3",
"versionType": "custom"
},
{
"lessThan": "1.0.4",
"status": "affected",
"version": "1.0.4",
"versionType": "custom"
}
]
},
{
"product": "Total GDPR Compliance Lite \u2013 WordPress Plugin for GDPR Compatibility",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.4"
}
]
},
{
"product": "Total Team Lite \u2013 Responsive Team Manager / Showcase Plugin for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.1*",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.1.2",
"status": "affected",
"version": "1.1.2",
"versionType": "custom"
}
]
},
{
"product": "Free Responsive Post/Article Author Section Plugin for WordPress \u2013 Ultimate Author Box Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.2*",
"status": "affected",
"version": "1.1.2",
"versionType": "custom"
},
{
"lessThan": "1.1.3",
"status": "affected",
"version": "1.1.3",
"versionType": "custom"
}
]
},
{
"product": "Contact Form for WordPress \u2013 Ultimate Form Builder Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.5.0*",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
},
{
"lessThan": "1.5.1",
"status": "affected",
"version": "1.5.1",
"versionType": "custom"
}
]
},
{
"product": "Badge Designer Lite For WooCommerce",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.0*",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
},
{
"lessThan": "1.1.1",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
}
]
},
{
"product": "WordPress Slider Plugin \u2013 WP 1 Slider",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.2.9*",
"status": "affected",
"version": "1.2.9",
"versionType": "custom"
},
{
"lessThan": "1.3.0",
"status": "affected",
"version": "1.3.0",
"versionType": "custom"
}
]
},
{
"product": "Plugin to Manage / Design WordPress Blog \u2013 WP Blog Manager Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.1*",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.1.2",
"status": "affected",
"version": "1.1.2",
"versionType": "custom"
}
]
},
{
"product": "Smartest Way To Design \u0026 Customize WordPress Comments \u0026 Comment Form \u2013 WP Comment Designer Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.3*",
"status": "affected",
"version": "2.0.3",
"versionType": "custom"
},
{
"lessThan": "2.0.4",
"status": "affected",
"version": "2.0.4",
"versionType": "custom"
}
]
},
{
"product": "Cookie Notification Plugin for WordPress \u2013 WP Cookie User Info",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.7*",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
},
{
"lessThan": "1.0.8",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
}
]
},
{
"product": "Social Review",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
}
]
},
{
"product": "MContact Button",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.7",
"status": "affected",
"version": "2.0.7",
"versionType": "custom"
}
]
},
{
"product": "WP Floating Menu \u2013 One page navigator, sticky menu for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.4.4*",
"status": "affected",
"version": "1.4.4",
"versionType": "custom"
},
{
"lessThan": "1.4.5",
"status": "affected",
"version": "1.4.5",
"versionType": "custom"
}
]
},
{
"product": "The Easiest WordPress Media Manager Plugin \u2013 WP Media Manager Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.2*",
"status": "affected",
"version": "1.1.2",
"versionType": "custom"
},
{
"lessThan": "1.1.3",
"status": "affected",
"version": "1.1.3",
"versionType": "custom"
}
]
},
{
"product": "WP Popup Banners",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.2.3*",
"status": "affected",
"version": "1.2.3",
"versionType": "custom"
},
{
"lessThan": "1.2.4",
"status": "affected",
"version": "1.2.4",
"versionType": "custom"
}
]
},
{
"product": "WP Popup Lite \u2013 Responsive popup plugin for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.8"
}
]
},
{
"product": "Responsive Products Showcase Listing for WordPress \u2013 WP Product Gallery Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.1.1"
}
]
},
{
"product": "accessbuddy",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.0"
}
]
},
{
"product": "Accesspress Basic",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "3.2.1"
}
]
},
{
"product": "Accesspress Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.92"
}
]
},
{
"product": "Accesspress Mag",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.6.5"
}
]
},
{
"product": "AccessPress Parallax",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "4.5"
}
]
},
{
"product": "accesspress-ray",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.19.5"
}
]
},
{
"product": "AccessPress Root",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.5"
}
]
},
{
"product": "AccessPress Staple",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.9.1"
}
]
},
{
"product": "AccessPress Store",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.4.9"
}
]
},
{
"product": "Agency Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.1.6"
}
]
},
{
"product": "Aplite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.6"
}
]
},
{
"product": "Bingle",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.4"
}
]
},
{
"product": "Bloger",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.6"
}
]
},
{
"product": "Construction Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.5"
}
]
},
{
"product": "Doko",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.27"
}
]
},
{
"product": "Enlighten",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.5"
}
]
},
{
"product": "FashStore",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.1"
}
]
},
{
"product": "FotoGraphy",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.4.0"
}
]
},
{
"product": "Gaga Corp",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.8"
}
]
},
{
"product": "Gaga Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.4.2 1.0.8"
}
]
},
{
"product": "One Paze",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.2.8"
}
]
},
{
"product": "parallax-blog",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "3.1.1574941215"
}
]
},
{
"product": "ParallaxSome",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.6"
}
]
},
{
"product": "Punte",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.1.2"
}
]
},
{
"product": "Revolve",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Ripple",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.0"
}
]
},
{
"product": "ScrollMe",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.1.0"
}
]
},
{
"product": "SportsMag",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.1"
}
]
},
{
"product": "StoreVilla",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.4.1"
}
]
},
{
"product": "Swing Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.1.9"
}
]
},
{
"product": "The Launcher",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.2"
}
]
},
{
"product": "The Monday",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.4.1"
}
]
},
{
"product": "Uncode Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Unicon Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.6"
}
]
},
{
"product": "VMag",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.7"
}
]
},
{
"product": "VMagazine Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.5"
}
]
},
{
"product": "Vmagazine News",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.5"
}
]
},
{
"product": "Zigcy Baby",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.6"
}
]
},
{
"product": "Zigcy Cosmetics",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.5"
}
]
},
{
"product": "Zigcy Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.0.9"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Harald Eilertsen (Jetpack Scan)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-21T10:45:39.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Backdoored Plugins \u0026 Themes from AccessPress Themes",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24867",
"STATE": "PUBLIC",
"TITLE": "Backdoored Plugins \u0026 Themes from AccessPress Themes"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Frontend Post WordPress Plugin \u2013 AccessPress Anonymous Post",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.8.0",
"version_value": "2.8.0"
},
{
"version_affected": "\u003c",
"version_name": "2.8.1",
"version_value": "2.8.1"
}
]
}
},
{
"product_name": "AccessPress Custom CSS",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.1",
"version_value": "2.0.1"
},
{
"version_affected": "\u003c",
"version_name": "2.0.2",
"version_value": "2.0.2"
}
]
}
},
{
"product_name": "AccessPress Custom Post Type",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.8",
"version_value": "1.0.8"
},
{
"version_affected": "\u003c",
"version_name": "1.0.9",
"version_value": "1.0.9"
}
]
}
},
{
"product_name": "Social Auto Poster",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.1.3",
"version_value": "2.1.3"
},
{
"version_affected": "\u003c",
"version_name": "2.1.4",
"version_value": "2.1.4"
}
]
}
},
{
"product_name": "AccessPress iFeeds",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "4.0.3",
"version_value": "4.0.3"
},
{
"version_affected": "\u003c",
"version_name": "4.0.4",
"version_value": "4.0.4"
}
]
}
},
{
"product_name": "PI Button",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "3.3.3",
"version_value": "3.3.3"
},
{
"version_affected": "\u003c",
"version_name": "3.3.4",
"version_value": "3.3.4"
}
]
}
},
{
"product_name": "AccessPress Social Counter",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.9.1",
"version_value": "1.9.1"
},
{
"version_affected": "\u003c",
"version_name": "1.9.2",
"version_value": "1.9.2"
}
]
}
},
{
"product_name": "AccessPress Social Icons",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.8.2",
"version_value": "1.8.2"
},
{
"version_affected": "\u003c",
"version_name": "1.8.3",
"version_value": "1.8.3"
}
]
}
},
{
"product_name": "AccessPress Social Login Lite \u2013 Social Login WordPress Plugin",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "3.4.7",
"version_value": "3.4.7"
},
{
"version_affected": "\u003c",
"version_name": "3.4.8",
"version_value": "3.4.8"
}
]
}
},
{
"product_name": "AccessPress Social Share",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "4.5.5",
"version_value": "4.5.5"
},
{
"version_affected": "\u003c",
"version_name": "4.5.6",
"version_value": "4.5.6"
}
]
}
},
{
"product_name": "TAuto Poster",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.4.5",
"version_value": "1.4.5"
},
{
"version_affected": "\u003c",
"version_name": "1.4.6",
"version_value": "1.4.6"
}
]
}
},
{
"product_name": "WP TFeed",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.6.7",
"version_value": "1.6.7"
},
{
"version_affected": "\u003c",
"version_name": "1.6.8",
"version_value": "1.6.8"
}
]
}
},
{
"product_name": "Effectively Add \u0026 Customize Free Icons For WordPress Menus \u2013 WP Menu Icons Lite",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.9",
"version_value": "1.0.9"
}
]
}
},
{
"product_name": "AP Companion",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.7",
"version_value": "1.0.7"
}
]
}
},
{
"product_name": "Easiest Contact Form for WordPress \u2013 AP Contact Form",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.6",
"version_value": "1.0.6"
},
{
"version_affected": "\u003c",
"version_name": "1.0.7",
"version_value": "1.0.7"
}
]
}
},
{
"product_name": "Testimonial WordPress Plugin \u2013 AP Custom Testimonial",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.4.6",
"version_value": "1.4.6"
},
{
"version_affected": "\u003c",
"version_name": "1.4.7",
"version_value": "1.4.7"
}
]
}
},
{
"product_name": "Mega Menu Plugin for WordPress \u2013 AP Mega Menu",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "3.0.5",
"version_value": "3.0.5"
},
{
"version_affected": "\u003c",
"version_name": "3.0.6",
"version_value": "3.0.6"
}
]
}
},
{
"product_name": "Pricing Table Builder \u2013 AP Pricing Tables Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.3",
"version_value": "1.1.3"
},
{
"version_affected": "\u003c",
"version_name": "1.1.3",
"version_value": "1.1.3"
}
]
}
},
{
"product_name": "Responsive Notification Bar Plugin for WordPress \u2013 Apex Notification Bar Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.4",
"version_value": "2.0.4"
},
{
"version_affected": "\u003c",
"version_name": "2.0.5",
"version_value": "2.0.5"
}
]
}
},
{
"product_name": "Form Store to DB",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.9",
"version_value": "1.0.9"
},
{
"version_affected": "\u003c",
"version_name": "1.1.0",
"version_value": "1.1.0"
}
]
}
},
{
"product_name": "Comments Disable \u2013 AccessPress",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.7",
"version_value": "1.0.7"
},
{
"version_affected": "\u003c",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "CTA plugin for WordPress \u2013 Easy Side Tab",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.7",
"version_value": "1.0.7"
},
{
"version_affected": "\u003c",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "WordPress Backend Customizer \u2013 Everest Admin Theme Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.7",
"version_value": "1.0.7"
},
{
"version_affected": "\u003c",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "Ultimate Coming Soon, Maintenance Mode Plugin for WordPress \u2013 Everest Coming Soon Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.0",
"version_value": "1.1.0"
},
{
"version_affected": "\u003c",
"version_name": "1.1.1",
"version_value": "1.1.1"
}
]
}
},
{
"product_name": "Free WordPress Plugin To Display Like/Dislike Comment Rating \u2013 Everest Comment Rating Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.4",
"version_value": "2.0.4"
},
{
"version_affected": "\u003c",
"version_name": "2.0.5",
"version_value": "2.0.5"
}
]
}
},
{
"product_name": "Beautiful Stat Counter Plugin for WordPress \u2013 Everest Counter Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.7",
"version_value": "2.0.7"
},
{
"version_affected": "\u003c",
"version_name": "2.0.8",
"version_value": "2.0.8"
}
]
}
},
{
"product_name": "Beautiful FAQ Plugin for WordPress \u2013 Everest FAQ Manager Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.8",
"version_value": "1.0.8"
},
{
"version_affected": "\u003c",
"version_name": "1.0.9",
"version_value": "1.0.9"
}
]
}
},
{
"product_name": "Responsive Media Gallery Plugin for WordPress \u2013 Everest Gallery Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.8",
"version_value": "1.0.8"
},
{
"version_affected": "\u003c",
"version_name": "1.0.9",
"version_value": "1.0.9"
}
]
}
},
{
"product_name": "Everest GPlaces Business Reviews",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.9",
"version_value": "1.0.9"
},
{
"version_affected": "\u003c",
"version_name": "2.0.0",
"version_value": "2.0.0"
}
]
}
},
{
"product_name": "Everest Review Lite \u2013 User/Admin review plugin for WordPress",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.7",
"version_value": "1.0.7"
}
]
}
},
{
"product_name": "Free Responsive Tab Plugin For WordPress \u2013 Everest Tab Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.3",
"version_value": "2.0.3"
},
{
"version_affected": "\u003c",
"version_name": "2.0.4",
"version_value": "2.0.4"
}
]
}
},
{
"product_name": "Responsive WordPress Timeline Plugin \u2013 Everest Timeline Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.1",
"version_value": "1.1.1"
},
{
"version_affected": "\u003c",
"version_name": "1.1.2",
"version_value": "1.1.2"
}
]
}
},
{
"product_name": "Inline Call To Action Builder Lite \u2013 Free Call To Action Layer Plugin for WordPress",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.0",
"version_value": "1.1.0"
},
{
"version_affected": "\u003c",
"version_name": "1.1.1",
"version_value": "1.1.1"
}
]
}
},
{
"product_name": "Product Slider For WooCommerce Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.5",
"version_value": "1.1.5"
},
{
"version_affected": "\u003c",
"version_name": "1.1.6",
"version_value": "1.1.6"
}
]
}
},
{
"product_name": "Responsive Clients Logo Gallery Plugin for WordPress \u2013 Smart Logo Showcase Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.7",
"version_value": "1.1.7"
},
{
"version_affected": "\u003c",
"version_name": "1.1.8",
"version_value": "1.1.8"
}
]
}
},
{
"product_name": "Smart Scroll Posts for WordPress",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.8",
"version_value": "2.0.8"
},
{
"version_affected": "\u003c",
"version_name": "2.0.9",
"version_value": "2.0.9"
}
]
}
},
{
"product_name": "Faster and Easier scroll to Top Plugin for WordPress \u2013 Smart Scroll to Top Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.3",
"version_value": "1.0.3"
},
{
"version_affected": "\u003c",
"version_name": "1.0.4",
"version_value": "1.0.4"
}
]
}
},
{
"product_name": "Total GDPR Compliance Lite \u2013 WordPress Plugin for GDPR Compatibility",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.4",
"version_value": "1.0.4"
}
]
}
},
{
"product_name": "Total Team Lite \u2013 Responsive Team Manager / Showcase Plugin for WordPress",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.1",
"version_value": "1.1.1"
},
{
"version_affected": "\u003c",
"version_name": "1.1.2",
"version_value": "1.1.2"
}
]
}
},
{
"product_name": "Free Responsive Post/Article Author Section Plugin for WordPress \u2013 Ultimate Author Box Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.2",
"version_value": "1.1.2"
},
{
"version_affected": "\u003c",
"version_name": "1.1.3",
"version_value": "1.1.3"
}
]
}
},
{
"product_name": "Contact Form for WordPress \u2013 Ultimate Form Builder Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.5.0",
"version_value": "1.5.0"
},
{
"version_affected": "\u003c",
"version_name": "1.5.1",
"version_value": "1.5.1"
}
]
}
},
{
"product_name": "Badge Designer Lite For WooCommerce",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.0",
"version_value": "1.1.0"
},
{
"version_affected": "\u003c",
"version_name": "1.1.1",
"version_value": "1.1.1"
}
]
}
},
{
"product_name": "WordPress Slider Plugin \u2013 WP 1 Slider",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.2.9",
"version_value": "1.2.9"
},
{
"version_affected": "\u003c",
"version_name": "1.3.0",
"version_value": "1.3.0"
}
]
}
},
{
"product_name": "Plugin to Manage / Design WordPress Blog \u2013 WP Blog Manager Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.1",
"version_value": "1.1.1"
},
{
"version_affected": "\u003c",
"version_name": "1.1.2",
"version_value": "1.1.2"
}
]
}
},
{
"product_name": "Smartest Way To Design \u0026 Customize WordPress Comments \u0026 Comment Form \u2013 WP Comment Designer Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.3",
"version_value": "2.0.3"
},
{
"version_affected": "\u003c",
"version_name": "2.0.4",
"version_value": "2.0.4"
}
]
}
},
{
"product_name": "Cookie Notification Plugin for WordPress \u2013 WP Cookie User Info",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.7",
"version_value": "1.0.7"
},
{
"version_affected": "\u003c",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "Social Review",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.9",
"version_value": "1.0.9"
}
]
}
},
{
"product_name": "MContact Button",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "2.0.7",
"version_value": "2.0.7"
}
]
}
},
{
"product_name": "WP Floating Menu \u2013 One page navigator, sticky menu for WordPress",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.4.4",
"version_value": "1.4.4"
},
{
"version_affected": "\u003c",
"version_name": "1.4.5",
"version_value": "1.4.5"
}
]
}
},
{
"product_name": "The Easiest WordPress Media Manager Plugin \u2013 WP Media Manager Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.2",
"version_value": "1.1.2"
},
{
"version_affected": "\u003c",
"version_name": "1.1.3",
"version_value": "1.1.3"
}
]
}
},
{
"product_name": "WP Popup Banners",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.2.3",
"version_value": "1.2.3"
},
{
"version_affected": "\u003c",
"version_name": "1.2.4",
"version_value": "1.2.4"
}
]
}
},
{
"product_name": "WP Popup Lite \u2013 Responsive popup plugin for WordPress",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "Responsive Products Showcase Listing for WordPress \u2013 WP Product Gallery Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.1.1",
"version_value": "1.1.1"
}
]
}
},
{
"product_name": "accessbuddy",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.0",
"version_value": "1.0.0"
}
]
}
},
{
"product_name": "Accesspress Basic",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "3.2.1",
"version_value": "3.2.1"
}
]
}
},
{
"product_name": "Accesspress Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.92",
"version_value": "2.92"
}
]
}
},
{
"product_name": "Accesspress Mag",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.6.5",
"version_value": "2.6.5"
}
]
}
},
{
"product_name": "AccessPress Parallax",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "4.5",
"version_value": "4.5"
}
]
}
},
{
"product_name": "accesspress-ray",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.19.5",
"version_value": "1.19.5"
}
]
}
},
{
"product_name": "AccessPress Root",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.5",
"version_value": "2.5"
}
]
}
},
{
"product_name": "AccessPress Staple",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.9.1",
"version_value": "1.9.1"
}
]
}
},
{
"product_name": "AccessPress Store",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.4.9",
"version_value": "2.4.9"
}
]
}
},
{
"product_name": "Agency Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.1.6",
"version_value": "1.1.6"
}
]
}
},
{
"product_name": "Aplite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.6",
"version_value": "1.0.6"
}
]
}
},
{
"product_name": "Bingle",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.4",
"version_value": "1.0.4"
}
]
}
},
{
"product_name": "Bloger",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.6",
"version_value": "1.2.6"
}
]
}
},
{
"product_name": "Construction Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.5",
"version_value": "1.2.5"
}
]
}
},
{
"product_name": "Doko",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.27",
"version_value": "1.0.27"
}
]
}
},
{
"product_name": "Enlighten",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.5",
"version_value": "1.3.5"
}
]
}
},
{
"product_name": "FashStore",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.1",
"version_value": "1.2.1"
}
]
}
},
{
"product_name": "FotoGraphy",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.4.0",
"version_value": "2.4.0"
}
]
}
},
{
"product_name": "Gaga Corp",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "Gaga Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.4.2",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "One Paze",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.2.8",
"version_value": "2.2.8"
}
]
}
},
{
"product_name": "parallax-blog",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "3.1.1574941215",
"version_value": "3.1.1574941215"
}
]
}
},
{
"product_name": "ParallaxSome",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.6",
"version_value": "1.3.6"
}
]
}
},
{
"product_name": "Punte",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.1.2",
"version_value": "1.1.2"
}
]
}
},
{
"product_name": "Revolve",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.1",
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Ripple",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.0",
"version_value": "1.2.0"
}
]
}
},
{
"product_name": "ScrollMe",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.1.0",
"version_value": "2.1.0"
}
]
}
},
{
"product_name": "SportsMag",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.1",
"version_value": "1.2.1"
}
]
}
},
{
"product_name": "StoreVilla",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.4.1",
"version_value": "1.4.1"
}
]
}
},
{
"product_name": "Swing Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.1.9",
"version_value": "1.1.9"
}
]
}
},
{
"product_name": "The Launcher",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.2",
"version_value": "1.3.2"
}
]
}
},
{
"product_name": "The Monday",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.4.1",
"version_value": "1.4.1"
}
]
}
},
{
"product_name": "Uncode Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.1",
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Unicon Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.6",
"version_value": "1.2.6"
}
]
}
},
{
"product_name": "VMag",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.7",
"version_value": "1.2.7"
}
]
}
},
{
"product_name": "VMagazine Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.5",
"version_value": "1.3.5"
}
]
}
},
{
"product_name": "Vmagazine News",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.5",
"version_value": "1.0.5"
}
]
}
},
{
"product_name": "Zigcy Baby",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.6",
"version_value": "1.0.6"
}
]
}
},
{
"product_name": "Zigcy Cosmetics",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.5",
"version_value": "1.0.5"
}
]
}
},
{
"product_name": "Zigcy Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.0.9",
"version_value": "2.0.9"
}
]
}
}
]
},
"vendor_name": "AccessPress Themes"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Harald Eilertsen (Jetpack Scan)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912 Hidden Functionality"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff"
},
{
"name": "https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/",
"refsource": "MISC",
"url": "https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24867",
"datePublished": "2022-02-21T10:45:39.000Z",
"dateReserved": "2021-01-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T19:49:13.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-25371 (GCVE-0-2021-25371)
Vulnerability from cvelistv5 – Published: 2021-03-26 18:24 – Updated: 2025-10-21 23:25
VLAI
Summary
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
Severity
6.1 (Medium)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://security.samsungmobile.com/securityUpdate.smsb | x_refsource_CONFIRM |
| https://security.samsungmobile.com | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Samsung Mobile | Samsung Mobile Devices |
Affected:
Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830 , < SMR Mar-2021 Release 1
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:03:05.300Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.samsungmobile.com/securityUpdate.smsb"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security.samsungmobile.com"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-25371",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T21:25:24.513863Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2023-06-29",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25371"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:25:51.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25371"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-06-29T00:00:00.000Z",
"value": "CVE-2021-25371 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Samsung Mobile Devices",
"vendor": "Samsung Mobile",
"versions": [
{
"lessThan": "SMR Mar-2021 Release 1",
"status": "affected",
"version": "Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912: Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-26T18:24:15.000Z",
"orgId": "3af57064-a867-422c-b2ad-40307b65c458",
"shortName": "Samsung Mobile"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.samsungmobile.com/securityUpdate.smsb"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security.samsungmobile.com"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "mobile.security@samsung.com",
"ID": "CVE-2021-25371",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Samsung Mobile Devices",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830",
"version_value": "SMR Mar-2021 Release 1"
}
]
}
}
]
},
"vendor_name": "Samsung Mobile"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912: Hidden Functionality"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://security.samsungmobile.com/securityUpdate.smsb",
"refsource": "CONFIRM",
"url": "https://security.samsungmobile.com/securityUpdate.smsb"
},
{
"name": "https://security.samsungmobile.com",
"refsource": "MISC",
"url": "https://security.samsungmobile.com"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458",
"assignerShortName": "Samsung Mobile",
"cveId": "CVE-2021-25371",
"datePublished": "2021-03-26T18:24:15.000Z",
"dateReserved": "2021-01-19T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:25:51.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-36403 (GCVE-0-2021-36403)
Vulnerability from cvelistv5 – Published: 2023-03-06 00:00 – Updated: 2025-03-07 17:58
VLAI
Summary
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
Severity
5.3 (Medium)
CWE
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:54:51.412Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://moodle.org/mod/forum/discuss.php?d=424809"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-36403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-07T17:58:43.664009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-07T17:58:48.597Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Moodle",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-06T00:00:00.000Z",
"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
"shortName": "fedora"
},
"references": [
{
"url": "https://moodle.org/mod/forum/discuss.php?d=424809"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
"assignerShortName": "fedora",
"cveId": "CVE-2021-36403",
"datePublished": "2023-03-06T00:00:00.000Z",
"dateReserved": "2021-07-12T00:00:00.000Z",
"dateUpdated": "2025-03-07T17:58:48.597Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-4229 (GCVE-0-2021-4229)
Vulnerability from cvelistv5 – Published: 2022-05-24 15:30 – Updated: 2025-04-15 14:38
VLAI
Title
ua-parser-js Crypto Mining backdoor
Summary
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.
Severity
5 (Medium)
CWE
- CWE-912 - Backdoor
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/advisories/GHSA-pjwm-rvh2-c87w | x_refsource_MISC |
| https://github.com/faisalman/ua-parser-js/issues/536 | x_refsource_MISC |
| https://vuldb.com/?id.185453 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unspecified | ua-parser-js |
Affected:
0.7.29
Affected: 0.8.0 Affected: 1.0.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:23:08.902Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/faisalman/ua-parser-js/issues/536"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.185453"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-4229",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:14:48.297471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:38:30.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ua-parser-js",
"vendor": "unspecified",
"versions": [
{
"status": "affected",
"version": "0.7.29"
},
{
"status": "affected",
"version": "0.8.0"
},
{
"status": "affected",
"version": "1.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Backdoor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-24T15:30:35.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/faisalman/ua-parser-js/issues/536"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.185453"
}
],
"title": "ua-parser-js Crypto Mining backdoor",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2021-4229",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "ua-parser-js Crypto Mining backdoor"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ua-parser-js",
"version": {
"version_data": [
{
"version_value": "0.7.29"
},
{
"version_value": "0.8.0"
},
{
"version_value": "1.0.0"
}
]
}
}
]
},
"vendor_name": ""
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "5.0",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912 Backdoor"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w",
"refsource": "MISC",
"url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
},
{
"name": "https://github.com/faisalman/ua-parser-js/issues/536",
"refsource": "MISC",
"url": "https://github.com/faisalman/ua-parser-js/issues/536"
},
{
"name": "https://vuldb.com/?id.185453",
"refsource": "MISC",
"url": "https://vuldb.com/?id.185453"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2021-4229",
"datePublished": "2022-05-24T15:30:35.000Z",
"dateReserved": "2022-05-24T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:38:30.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43987 (GCVE-0-2021-43987)
Vulnerability from cvelistv5 – Published: 2021-12-23 19:48 – Updated: 2024-09-16 23:35
VLAI
Title
mySCADA myPRO
Summary
An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface.
Severity
9.8 (Critical)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_MISC |
Date Public
2021-12-21 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:10:17.102Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "myPRO",
"vendor": "mySCADA",
"versions": [
{
"lessThanOrEqual": "8.20.0",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-12-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-23T19:48:36.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01"
}
],
"solutions": [
{
"lang": "en",
"value": "mySCADA recommends users upgrade to Version 8.22.0 or higher. For more information, contact mySCADA technical support."
}
],
"source": {
"advisory": "ICSA-21-355-01",
"discovery": "UNKNOWN"
},
"title": "mySCADA myPRO",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2021-12-21T17:26:00.000Z",
"ID": "CVE-2021-43987",
"STATE": "PUBLIC",
"TITLE": "mySCADA myPRO"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "myPRO",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "All",
"version_value": "8.20.0"
}
]
}
}
]
},
"vendor_name": "mySCADA"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912 Hidden Functionality"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01"
}
]
},
"solution": [
{
"lang": "en",
"value": "mySCADA recommends users upgrade to Version 8.22.0 or higher. For more information, contact mySCADA technical support."
}
],
"source": {
"advisory": "ICSA-21-355-01",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-43987",
"datePublished": "2021-12-23T19:48:36.147Z",
"dateReserved": "2021-11-17T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:35:29.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1741 (GCVE-0-2022-1741)
Vulnerability from cvelistv5 – Published: 2022-06-24 15:00 – Updated: 2025-04-17 18:47
VLAI
Title
2.2.3 HIDDEN FUNCTIONALITY CWE-912
Summary
The tested version of Dominion Voting Systems ImageCast X has a Terminal Emulator application which could be leveraged by an attacker to gain elevated privileges on a device and/or install malicious code.
Severity
6.8 (Medium)
CWE
- CWE-912 - cwe-912
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dominion Voting Systems | ImageCast X application |
Affected:
Version 5.5-A Versions 5.5.10.30 and 5.5.10.32
|
|
| Dominion Voting Systems | ImageCast X firmware |
Affected:
Version 5.5-A
|
Date Public
2022-06-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:16:59.822Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2022-1741",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-17T15:57:42.089356Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-17T18:47:11.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageCast X application",
"vendor": "Dominion Voting Systems",
"versions": [
{
"status": "affected",
"version": "Version 5.5-A Versions 5.5.10.30 and 5.5.10.32"
}
]
},
{
"product": "ImageCast X firmware",
"vendor": "Dominion Voting Systems",
"versions": [
{
"status": "affected",
"version": "Version 5.5-A"
}
]
}
],
"datePublic": "2022-06-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The tested version of Dominion Voting Systems ImageCast X has a Terminal Emulator application which could be leveraged by an attacker to gain elevated privileges on a device and/or install malicious code."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "cwe-912",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T15:00:24.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "2.2.3 HIDDEN FUNCTIONALITY CWE-912",
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "20220603T06:00:00.000000Z",
"ID": "CVE-2022-1741",
"STATE": "PUBLIC",
"TITLE": "2.2.3 HIDDEN FUNCTIONALITY CWE-912"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ImageCast X application",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "Version 5.5-A",
"version_value": "Versions 5.5.10.30 and 5.5.10.32"
}
]
}
}
]
},
"vendor_name": "Dominion Voting Systems"
},
{
"product": {
"product_data": [
{
"product_name": "ImageCast X firmware",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "Version 5.5-A"
}
]
}
}
]
},
"vendor_name": "Dominion Voting Systems"
}
]
}
},
"credit": [],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The tested version of Dominion Voting Systems ImageCast X has a Terminal Emulator application which could be leveraged by an attacker to gain elevated privileges on a device and/or install malicious code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "cwe-912"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01"
}
]
},
"solution": [],
"source": {
"advisory": "",
"defect": [],
"discovery": "UNKNOWN"
},
"work_around": []
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2022-1741",
"datePublished": "2022-06-24T15:00:24.654Z",
"dateReserved": "2022-05-16T00:00:00.000Z",
"dateUpdated": "2025-04-17T18:47:11.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3203 (GCVE-0-2022-3203)
Vulnerability from cvelistv5 – Published: 2022-10-21 12:30 – Updated: 2025-05-07 14:06
VLAI
Title
ORing net IAP-420(+) Hidden Functionality
Summary
On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.
Severity
9.8 (Critical)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ORing | IAP-420(+) |
Affected:
FW 2.0m
|
Date Public
2022-10-21 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:00:10.865Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://mads.uniud.it/2022/09/lord-of-the-orings/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3203",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-07T14:06:15.814773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-07T14:06:37.577Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "IAP-420(+)",
"vendor": "ORing",
"versions": [
{
"status": "affected",
"version": "FW 2.0m"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Lorenzo Bazzana and Marino Miculan of Universit\u00e0 degli studi di Udine, Michele Codutti of Danieli Automation"
}
],
"datePublic": "2022-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-02T00:00:00.000Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://mads.uniud.it/2022/09/lord-of-the-orings/"
}
],
"source": {
"defect": [
"CERT@VDE#64203"
],
"discovery": "EXTERNAL"
},
"title": "ORing net IAP-420(+) Hidden Functionality",
"workarounds": [
{
"lang": "en",
"value": "After every reboot telnet to the device and terminate the telnetd process (at least)"
}
],
"x_generator": {
"engine": "vulnogram 0.1.0-rc1"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-3203",
"datePublished": "2022-10-21T12:30:12.353Z",
"dateReserved": "2022-09-13T00:00:00.000Z",
"dateUpdated": "2025-05-07T14:06:37.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-36429 (GCVE-0-2022-36429)
Vulnerability from cvelistv5 – Published: 2023-03-21 17:41 – Updated: 2024-08-03 10:07
VLAI
Summary
A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON object can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.
Severity
7.2 (High)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgear | Orbi Satellite RBS750 |
Affected:
4.6.8.5
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:07:33.896Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1597"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1597",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1597"
},
{
"name": "https://kb.netgear.com/000065424/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0188",
"tags": [
"x_transferred"
],
"url": "https://kb.netgear.com/000065424/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0188"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:netgear:rbs750_firmware:4.6.8.5:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rbs750_firmware",
"vendor": "netgear",
"versions": [
{
"status": "affected",
"version": "4.6.8.5"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-36429",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-01T15:42:46.126213Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-01T15:52:41.065Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Orbi Satellite RBS750",
"vendor": "Netgear",
"versions": [
{
"status": "affected",
"version": "4.6.8.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON object can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912: Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-29T10:14:37.184Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1597",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1597"
},
{
"name": "https://kb.netgear.com/000065424/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0188",
"url": "https://kb.netgear.com/000065424/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0188"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2022-36429",
"datePublished": "2023-03-21T17:41:25.748Z",
"dateReserved": "2022-08-23T17:55:12.245Z",
"dateUpdated": "2024-08-03T10:07:33.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3843 (GCVE-0-2022-3843)
Vulnerability from cvelistv5 – Published: 2023-02-16 14:58 – Updated: 2025-03-18 14:41
VLAI
Title
WAGO: Exposure of configuration interface in unmanaged switches
Summary
In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters.
Severity
9.1 (Critical)
CWE
- CWE-912 - Hidden functionality
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WAGO | Unmanaged Switch 852-111/000-001 |
Affected:
01
|
Date Public
2023-02-16 13:45
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:20:58.761Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-055/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3843",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-18T14:40:52.665516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-18T14:41:11.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unmanaged Switch 852-111/000-001",
"vendor": "WAGO",
"versions": [
{
"status": "affected",
"version": "01"
}
]
}
],
"datePublic": "2023-02-16T13:45:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters.\u003cbr\u003e"
}
],
"value": "In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-629",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-629 Unauthorized Use of Device Resources"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-16T14:58:44.343Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/en/advisories/VDE-2022-055/"
}
],
"source": {
"advisory": "VDE-2022-055",
"defect": [
"CERT@VDE#64279"
],
"discovery": "UNKNOWN"
},
"title": "WAGO: Exposure of configuration interface in unmanaged switches",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-3843",
"datePublished": "2023-02-16T14:58:44.343Z",
"dateReserved": "2022-11-02T17:42:15.118Z",
"dateUpdated": "2025-03-18T14:41:11.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Phase: Installation
Description:
- Always verify the integrity of the product that is being installed.
CAPEC-133: Try All Common Switches
An attacker attempts to invoke all common switches and options in the target application for the purpose of discovering weaknesses in the target. For example, in some applications, adding a --debug switch causes debugging information to be displayed, which can sometimes reveal sensitive processing or configuration information to an attacker. This attack differs from other forms of API abuse in that the attacker is indiscriminately attempting to invoke options in the hope that one of them will work rather than specifically targeting a known option. Nonetheless, even if the attacker is familiar with the published options of a targeted application this attack method may still be fruitful as it might discover unpublicized functionality.
CAPEC-190: Reverse Engineer an Executable to Expose Assumed Hidden Functionality
An attacker analyzes a binary file or executable for the purpose of discovering the structure, function, and possibly source-code of the file by using a variety of analysis techniques to effectively determine how the software functions and operates. This type of analysis is also referred to as Reverse Code Engineering, as techniques exist for extracting source code from an executable. Several techniques are often employed for this purpose, both black box and white box. The use of computer bus analyzers and packet sniffers allows the binary to be studied at a level of interactions with its computing environment, such as a host OS, inter-process communication, and/or network communication. This type of analysis falls into the 'black box' category because it involves behavioral analysis of the software without reference to source code, object code, or protocol specifications.